https://community.splunk.com/t5/Splunk-Search/How-to-mask-both-index-and-search-time-data-and-how-to-verify-if/m-p/169496#M186247 <P>The Getting Data In manual has a topic about how to <A href="http://docs.splunk.com/Documentation/Splunk/6.1.4/Data/Anonymizedatausingconfigurationfiles">mask data when indexing</A>. At search time, you could use a regex in your search, or the scrub command. There is also an <A href="https://apps.splunk.com/app/282/">Encrypt/Decrypt</A> app you might want to look at.</P> <P>I see you have posted several variations on this question in the past day or two. You should try to consolidate your postings to a single request that includes all the information. That will give the community the best chance of answering you.</P> Fri, 17 Oct 2014 17:58:52 GMT ChrisG 2014-10-17T17:58:52Z https://community.splunk.com/t5/Splunk-Search/How-to-mask-both-index-and-search-time-data-and-how-to-verify-if/m-p/169495#M186246 <P>How to mask index and search time data?</P> <P>How to verify if it is masked?</P> Fri, 17 Oct 2014 17:13:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-mask-both-index-and-search-time-data-and-how-to-verify-if/m-p/169495#M186246 ginger8990 2014-10-17T17:13:30Z https://community.splunk.com/t5/Splunk-Search/How-to-mask-both-index-and-search-time-data-and-how-to-verify-if/m-p/169496#M186247 <P>The Getting Data In manual has a topic about how to <A href="http://docs.splunk.com/Documentation/Splunk/6.1.4/Data/Anonymizedatausingconfigurationfiles">mask data when indexing</A>. At search time, you could use a regex in your search, or the scrub command. There is also an <A href="https://apps.splunk.com/app/282/">Encrypt/Decrypt</A> app you might want to look at.</P> <P>I see you have posted several variations on this question in the past day or two. You should try to consolidate your postings to a single request that includes all the information. That will give the community the best chance of answering you.</P> Fri, 17 Oct 2014 17:58:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-mask-both-index-and-search-time-data-and-how-to-verify-if/m-p/169496#M186247 ChrisG 2014-10-17T17:58:52Z https://community.splunk.com/t5/Splunk-Search/How-to-mask-both-index-and-search-time-data-and-how-to-verify-if/m-p/169497#M186248 <P>I didn't get the answer I want to know. SPlunk should has a way to verify the masking either in indexing or search time. BUt it didn't ..</P> <P>I have tried a different ways by following the instruction in the link of your posting and other posting, I could not see how SSN was masked </P> <P>I still saw SSN when doing the search....</P> Mon, 20 Oct 2014 16:41:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-mask-both-index-and-search-time-data-and-how-to-verify-if/m-p/169497#M186248 ginger8990 2014-10-20T16:41:16Z